Docling has SSRF guard bypass in remote resource fetching (DNS rebinding / multi-record resolution; no IP validation in HTML render mode)

### Summary When remote fetching is enabled (`enable_remote_fetch=True`, together with `fetch_images=True` or HTML `render_page=True`), docling's protection against requests to private and loopback addresses can be bypassed. - The URL check resolves the host name once, to a single IPv4 address. The HTTP request then resolves it again. A name that returns a public A record together with an internal AAAA record, or one that changes its answer between the two lookups (DNS rebinding), reaches internal addresses. - The check and the HTTP request parse the URL differently. With a backslash in the authority, such as `http://127.0.0.1:8080\@1.1.1.1/x.png`, the check validates `1.1.1.1` while the HTTP client connects to `127.0.0.1:8080`. - In HTML browser-rendering mode (`render_page=True`), requests made by the page are allowed for any `http(s)` URL without an IP check. ### Details - `validate_url_safety` in `docling/backend/utils/image_resource_loader.py` calls `socket.gethostbyname()`, which returns one IPv4 address. It checks that address and then passes the original URL string to `requests`, which parses it again with urllib3 and resolves the name independently through `getaddrinfo`. `urllib.parse` treats a backslash in the authority as part of the host section, while urllib3 ends the authority there, so the two can pick different hosts. This loader is shared by the HTML, Markdown, AsciiDoc, OpenDocument and JATS backends. - `docling/backend/html_backend.py` routes browser requests in render mode. When `enable_remote_fetch` is set, it continues any `http(s)` request, including iframes and images, without resolving or checking the destination. JavaScript is disabled during rendering, so the browser path can only show internal responses passively in the page screenshot. It cannot read them and send them elsewhere. ### Affected configurations - Affected: callers that enable `enable_remote_fetch` (CLI: `--html-image-fetch remote` or `all`) and process untrusted documents. - Not affected: the default configuration (`enable_remote_fetch=False`). The main-URL fetch for `DocumentConverter.convert("https://...")` is implemented in docling-core and is tracked there. ### Impact Requests from the converting host to internal services such as cloud metadata endpoints and loopback services. Response content is exposed only when it decodes as an image or is rendered into the page screenshot. ### Patches Fixed in docling 2.132.0 by [#4420](https://github.com/docling-project/docling/pull/4420). The image loader now resolves the host once, requires every resolved address (IPv4 and IPv6, including IPv4-mapped, 6to4 and NAT64 forms) to be globally routable, and connects to one of the validated addresses, using the same parsed host for the check and the connection. Remote requests made during HTML browser rendering are downloaded by the same loader, and the browser itself stays offline. When a proxy is configured through environment variables, requests go through the proxy, which is then responsible for filtering destinations. ### Workarounds Upgrade to 2.132.0. For older versions: Keep `enable_remote_fetch=False` for untrusted documents, or block egress to private, link-local and loopback ranges at the network level.